Diffing Malware Samples to Find Changes

When to Use

• You have two related samples (suspected variants of one family) and want a fast, structural diff before a full BinDiff.
• You need to quantify similarity and pinpoint changed sections/imports for variant tracking.

Do not use this as authoritative function-level diffing — that requires BinDiff/Diaphora on disassembly. This skill does structural/statistical diffing and executes nothing.

Prerequisites

• Two sample files (read inertly). Optional: ssdeep/tlsh for fuzzy scores (degrade gracefully).

Workflow

Step 1: Structural diff

python scripts/analyst.py diff a.bin b.bin

Compares file size, per-section SHA-256 and entropy, and the import name sets, reporting added/ removed/changed sections and imports.

Step 2: Similarity score

Reports a byte-level similarity ratio and, if available, ssdeep/tlsh fuzzy-hash comparison scores.

Step 3: Prioritize changed regions

Changed sections (same name, different hash) and new imports are the high-value targets for deeper disassembly diffing.

Step 4: Document

Record what changed and the similarity score to support variant/lineage tracking.

Validation

• Section comparison keys on section name; identical sections report equal hashes.
• Import diff lists are accurate (added vs removed vs common).
• Fuzzy-hash scores are reported only when the library is available, else clearly omitted.

Pitfalls

• Recompilation shifting addresses makes raw byte diff noisy — rely on section/import structure.
• Packers making both samples look similar (packed) while the payloads differ — unpack first.
• Treating a high byte-similarity as proof of same author without corroboration.

References

• See references/api-reference.md for the differ.
• PE format and ssdeep references (linked in frontmatter).